DressArts

Old computer (semiconductor) engineer. ex-AMD, ex-Broadcom. Current Qualcomm.

[Md Ismail Šojal 🕷️ @0x0SojalSec]

WTF, $3000 Samsung TV has an always-on mic, automatic content recognition, geo tracking, network mapping, and ships your data to Samsung + 400 partners.

Bro Rooted a brand-new 2025 Samsung TV after noticing absurdly targeted ads.

Firmware was locked down, so zero-days it was.
Got a root shell.

then found: always-on voice service, ACR, geo, full telemetry pipeline, and four separate DRM systems.

This isn’t a bug, It’s the product bro.

[DressArts @StrasserDave]

Batten down the hatches…

[Jason D. Clinton 🔸 @JasonDClinton]

as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18 months.)

[AI Notkilleveryoneism Memes ⏸️ @AISafetyMemes]

This is the most serious 48 hours in cybersecurity history.

"Black October" they're calling it

It seems every *hour* there's a new incident, that in a typical year, would be one of the biggest incidents of the *entire year*

SUMMARY OF THE LAST 48 HOURS:

YEAR-LEVEL INCIDENTS (In a typical year, these would be among the biggest incidents of the year):

1. PHP2Shell: a hole in the software behind ~70% of websites. Governments took sites offline.
2. eMudhra: the master keys that prove websites are real were cracked. One was the number 4.
3. California: data on every public school student since 2023 stolen, including disability status
4. Railway: hackers stole customers' secret keys from a hosting platform used by millions of developers
5. Zeabur: 321,810 accounts breached. The company is shutting down.
6. LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer
7. GitLab: a 10-out-of-10 severity hole in every version since 2014
8. Cairn: criminals used an AI hacking tool to break into 100+ companies
9. Ahold Delhaize: hackers knocked the owner of Food Lion and Stop & Shop offline
10. Onamae: malware planted on up to 26,739 customer servers in Japan

MONTH-LEVEL INCIDENTS (In a typical month, these would be among the biggest incidents):

11. Signal: a bug could leave your mic and camera on after you hang up
12. NGINX: 3 critical holes in software running ~1/3 of websites
13. HTTP/3: a single connection can crash 7 of the 10 web server types tested
14. Plex: hackers breaking into home media servers
15. SafePay ransomware: FBI warns it has hit 600+ critical infrastructure organizations
16. Palo Alto: ransomware gangs breaking in through company firewalls
17. Bullhorn: platform used by 10,000+ companies knocked offline
18. Medi-Cal: 970,000 patients' data stolen
19. WordPress: hackers stole a plugin maker's keys and used them to plant backdoors on websites
20. AOMEI: backup software's update server handed out a backdoor
21. Meta Muse: Meta's AI agent exposed users' personal and business secrets
22. Tor: 333 relays hijacked to steal logins
23. TiDB Cloud: database company's cloud breached

Also serious:

24. State Bank of India: India's biggest bank confirms a data breach
25. OVHcloud: hackers slipped a password stealer into a cloud company's official tool
26. Siemens: a software hole being used to spread malware
27. North Korea: state hackers launch a new attack campaign on South Korea

[DressArts @StrasserDave]

I’m sure this is fine…

[unusual_whales @unusual_whales]

BREAKING: Major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some agents attempting to take actions that appear to be independent of user instructions, per Axios

[DressArts @StrasserDave]

@TGLetter @swatsonparcels Missed https://t.co/hN6ugWRmDf

[John Dorbal @JDorbal1989]

$ARM v $QCOM

We had oral argument today in the Third Circuit on Arm's appeal.

Boy did this bring back PTSD (I had suppressed from my memory Arm's absurd claim that Nuvia custom RTL was essentially theirs just because Nuvia implemented Arm architectural register definitions and opcodes into the RTL).

This was the long awaited appeal where Arm tried to overturn its loss in the Wilmington trial, while Qualcomm fought to defend its jury verdict on the Qualcomm Architecture License Agreement. The panel was active judges Peter Phipps and Arianna Freeman alongside senior judge Jane Roth.

What Arm is really after in this appeal is not just reviving its claim against Nuvia. Arm is trying to get a whole new trial on all counts, completely overriding the jury. Arm wants the appeals court to throw out the entire December 2024 verdict, erase Qualcomm jury win on Count 2 and the Qualcomm ALA counterclaim, and force everyone to relitigate the whole case from scratch.

Joseph Palmore stepped up to the podium first for Arm and went straight for the Qualcomm ALA counterclaim, arguing that Judge Noreika committed a category error by sending contract interpretation to the jury instead of deciding it as a pure question of law under Rule 50.

Palmore barely got into his stride before Judge Phipps interrupted and went straight for the contract language. Phipps asked Palmore about the word 'developed' in the core definition 'developed by or for Qualcomm'. Phipps asked point blank whether 'developed' was ambiguous, pointing out that 'developed' does not mean 'solely developed' on its face, and asking whether Qualcomm taking code from Nuvia and finishing it counts as 'developed by Qualcomm'. Palmore had to admit that the contract does not say 'solely developed', claiming instead that all stages of implementation in another section meant Qualcomm had to do everything from scratch. Phipps pushed right back, asking whether what the parties agreed to and what they meant was a factual question for the jury. That was an immediate hit to Arm entire theory that the contract unambiguously favored Arm as a pure legal question.

Judge Freeman then jumped in on the procedural side, grilling Palmore on invited error and waiver. She pressed Palmore on how a pending Rule 50 motion could insulate Arm when Arm actively participated in drafting the jury instructions, never made a specific Rule 51 objection to giving the jury the question, and argued the meaning of the contract to the jurors in closing.

When Palmore pivoted to the Nuvia breach claim and Judge Noreika post trial judgment on harm, Judge Phipps threw a massive curveball. Phipps asked Palmore about the ultimate remedy Arm is seeking, which is specific performance to destroy the chips. Phipps pointed out that equity only grants specific performance when there is no adequate remedy at law, so if Arm real injury is lost royalties, that is an adequate legal remedy that legally forecloses an order destroying silicon. Phipps asked why the Third Circuit should not treat Noreika ruling as harmless error if Arm requested remedy was impossible anyway.

Kannon Shanmugam took the podium next for Qualcomm, and he led with Rule 39 and invited error, showing how Arm consented before trial to send the factual predicates of the counterclaim to the jury. He worked to dismantle Arm textual reading of the ALA, explaining that Qualcomm did all the actual core design and that Arm 'capital T' defined Arm Technology did not apply to Nuvia RTL because Arm never designed, owned, or created the Nuvia code.

Shanmugam then ran into heavy questioning from Judge Freeman on the Nuvia breach claim. Freeman spent nearly all of her time hammering Qualcomm on Judge Noreika's decision granting judgment on harm after the hung jury. She zeroed in on the fatal procedural defect, which is that the jury was never given a limiting instruction telling them that lost royalties could not be used to prove harm. Freeman pointed out that the jury was just told go find harm, and she repeatedly challenged Shanmugam on how a trial judge can retroactively exclude trial evidence post verdict under Rule 37 when that evidence was already heard by the jurors without limitation.

Judge Phipps joined Freeman in questioning the Rule 37 ruling, noting that Rule 37 is normally an evidence bar rather than an argument bar. Phipps pointed out that once Qualcomm itself put in evidence of royalty savings to show motive, Arm was entitled to point to that trial record to show harm.

The argument wrapped up with a sharp fight over the scope of any retrial. Palmore argued that under Gasoline Products, any reversal on the Nuvia claim requires throwing out Qualcomm counterclaim victory and ordering a complete new trial on everything. Phipps pushed back hard on that theory, questioning why an affirmed jury verdict on Qualcomm ALA should be upset just because the jury hung on Nuvia. Shanmugam noted that Nuvia agreed not to raise issue preclusion on retrial, making the Nuvia breach cleanly separable.

On rebuttal Palmore tried to deflect the specific performance question by saying remedy comes after liability, but he could not undo the damage Phipps did to his contract interpretation argument. Phipps adjourned the court and took the matter under advisement.

You might be asking what happens next if the Third Circuit rejects Arm demand for a whole new trial on everything and sends only the Nuvia claim back. Does that mean Qualcomm is in trouble or that Arm gets to demand higher royalty rates on Qualcomm? In my opinion the answer is almost certainly no. That is why retrying only Nuvia is essentially a nothing burger for Qualcomm.

Qualcomm jury wins on Count two and Question three remain completely locked in as a permanent shield, establishing that Qualcomm custom cores are fully licensed under Qualcomm own agreement. And on retrial Arm cannot invent a brand new damages model against Nuvia because discovery closed years ago, and Arm spent the entire first trial insisting that money damages would not suffice.

My guess on how this shakes out is a split decision. In my opinion the panel looks very likely to protect Qualcomm jury verdict on Question two and three, while giving Arm a second shot on the Nuvia claim because of the procedural shortcuts around Judge Noreika Rule 50 ruling. But from where I sit that leaves Arm fighting a hollow battle against from what I understand, a defunct subsidiary, while Qualcomm's commercial business keeps rolling forward.

We'll have a decision hopefully before April 2027. If it's remanded back I can't wait for the extreme enthusiasm Judge Noreika will have to see these parties back again flooding her docket with thousands of pages that I'll have to read that wont matter in the end.

[NSA Cyber @NSACyber]

Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.

[unusual_whales @unusual_whales]

BREAKING: "Speculative data center debt is being repackaged and sold to pension and retirement funds, university endowments, and other institutional investors in a manner eerily reminiscent of the subprime bubble," per AFR

[DressArts @StrasserDave]

Money in politics seems to be working well…

[Laura Rozen @lrozen]

🧵WSJ: “Elon Musk ordered the slowdown of a military-grade version of Starlink relied on by Ukraine, a decision that sparked panic in Kyiv and confusion inside the Trump administration, U.S. officials and people familiar with the matter said. …

via @StevenJ1279

[Bev 🇨🇦 @Garnet_2203]

My fellow Albertans

[DressArts @StrasserDave]

May he be the first to give it up…

[Polymarket @Polymarket]

JUST IN: Elon Musk declares money will become irrelevant, predicting future currency will be measured in “wattage and tonnage.”

[Polymarket @Polymarket]

JUST IN: Trump administration sued over its 50% tariffs on Canadian goods.

[tae kim @firstadopter]

"Oct 20 (Reuters) - Qualcomm will cut jobs globally in a "performance-focused reduction" following its annual employee reviews, CEO Cristiano Amon told staff in a memo on Monday reviewed by Reuters, with notifications set to begin in November.

The cuts are part of an effort to build "a stronger performance culture" and address situations where the company "has consistently fallen short of expectations," Amon said."

[DressArts @StrasserDave]

Every 3-5 years

https://t.co/Yl9GJr8Z2a

[Robert Lee 🌃📝🎼 @downtownrob88]

"Norwegian undersea cable builder pitches 2,800-mile transatlantic data link between Canada and Europe to bypass the US. Canadian majority partner sought to help fund and build new $620 million fibre connection to reduce reliance on American routes." https://t.co/IAk70uzCTS

Time for the major Canadian cable firms to step up and partner up, to assist on this workaround Trump project. Those firms include Rogers, Bell, Videotron, Telus, Cogeco and Eastlink. We know cash flow is not an industry concern.

[Ed Zitron @edzitron]

This means that the increased price of RAM and consumer electronics was a result of an artificial "supply chain crisis" created by Jensen Huang pushing NVIDIA's customers to take early delivery of GPUs. Jensen Huang is responsible for making life worse for everyone.

[Matt Bracken @Matt_Bracken48]

Here is your East-Africa and West-Asia War Map.
"You can't tell the players without a scorecard." Or a good map.
And while size matters, population often matters more, so I added this critical number to each nation.

You'll want to save this map for when the sputtering Eritrea-Ethiopia conflict blows wide open again. Ethiopia has been landlocked since 1993, with the independence of Eritrea. There are parallels to Ukraine gaining its independence from Russia with the breakup of the USSR. Like the USSR, Ethiopia was down-and-out when Eritrea became a nation, and blocked Ethiopia from the Red Sea.

Now Ethiopia is undergoing a resurgence in power and influence. Their "Grand Ethiopian Renaissance Dam" was built between 2011 and 2025 when it was finished. This giant dam controls the headwaters and lakes of the Blue Nile, which provides 90% of Egypt's fresh water--and the Egyptians are not happy about this new situation.

And the Ethiopians want to regain access to the sea, either across Eritrea, or by making a deal with Somalia. The national government of Somalia opposes this, so Ethiopia supports the independence of "Somaliland," as shown on the map. The Ethiopians think: "this path to independence worked for Eritrea against our interests, so why not an independent Somaliland, working in our interest?" Somaliland would create a free-trade corridor for Ethiopia to the port of Berbera.

Egypt and Sudan already worry about a resurgent Ethiopia. With the opening of the GERD dam, Ethiopia became an electrical power production giant, with the biggest hydropower dam in Africa by far. It will generate even more power as more hydro turbines are put on line.

Did I mention that Ethiopia, similar to Iran, is almost 90% food self-sufficient? Now that it controls the Blue Nile, it's food production will go up even more, while Egypt feels the threat of water cutoffs, or floods, at Ethiopia's whim.

Did I mention that Ethiopia, population 140 million, is majority Orthodox Christian, as is South Sudan, in an otherwise Muslim region?

We are all watching the Iran-USA war and the Saudi-Yemen conflict, but also keep a weather eye on the other side of the Red Sea. Egypt, population 120 million, could be dragged into wars on both sides of it.

[The Hitchhiker's Guide to Self-Preservation @TheFATEof2021]

Russian Kosmos 2612 and ICEYE-X36 (providing Ukraine military support) are now in perfect sync with each other. The Russian military satellite is intentionally stalking and tracking the Western radar satellite. Keeping a satellite "bumper-to-bumper" in this manner allows Russia to intercept or jam data transmissions, physically inspect Western technology, or quickly pivot to execute a kinetic or non-kinetic anti-satellite (ASAT) attack with very little warning or fuel expenditure.

Kosmos 2612 executed a series of highly precise, fuel-heavy maneuvers to force itself into a "coplanar" orbit—matching ICEYE-X36's exact altitude (~555 km), speed, and inclination (~97.8°). The ICEYE-X36 satellite is giving the Ukraine military support.

[Carl Worker @carlworker]

This is meant to be good news?

[Marc Polymeropoulos @Mpolymer]

Such a phenomenal douche. Our allies fought and died next to us. I spent a butt load of time in Afghanistan (in far worse circumstances than this performative clown) and the only comment to our allies is “thank you.” That’s it. Heartfelt. Thank you. Also, he’s addressing ROTC students with this horseshit. That is just plain dangerous. Our next generation cannot be taught such BS.